Skip to content
AWS for Query.Farm

aws.iot.describe_audit_finding

Example SQL Queries

SELECT * FROM
aws.iot.describe_audit_finding
WHERE
"finding_id" = 'VALUE';

Description

Gets information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and the start time when the audit that returned the finding.

Requires permission to access the DescribeAuditFinding action.

Table Definition

Column NameColumn Data Type
finding_id Required Input Column

A unique identifier for a single audit finding. You can use this identifier to apply mitigation actions to the finding.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
finding

The findings (results) of the audit.

STRUCT(
    "finding_id" VARCHAR,
    "task_id" VARCHAR,
    "check_name" VARCHAR,
    "task_start_time" TIMESTAMP_S,
    "finding_time" TIMESTAMP_S,
    "severity" VARCHAR,
    "non_compliant_resource" STRUCT(
        "resource_type" VARCHAR,
        "resource_identifier" STRUCT(
            "device_certificate_id" VARCHAR,
            "ca_certificate_id" VARCHAR,
            "cognito_identity_pool_id" VARCHAR,
            "client_id" VARCHAR,
            "policy_version_identifier" STRUCT(
                "policy_name" VARCHAR,
                "policy_version_id" VARCHAR
            ),
            "account" VARCHAR,
            "iam_role_arn" VARCHAR,
            "role_alias_arn" VARCHAR,
            "issuer_certificate_identifier" STRUCT(
                "issuer_certificate_subject" VARCHAR,
                "issuer_id" VARCHAR,
                "issuer_certificate_serial_number" VARCHAR
            ),
            "device_certificate_arn" VARCHAR
        ),
        "additional_info" MAP(VARCHAR, VARCHAR)
    ),
    "related_resources" STRUCT(
        "resource_type" VARCHAR,
        "resource_identifier" STRUCT(
            "device_certificate_id" VARCHAR,
            "ca_certificate_id" VARCHAR,
            "cognito_identity_pool_id" VARCHAR,
            "client_id" VARCHAR,
            "policy_version_identifier" STRUCT(
                "policy_name" VARCHAR,
                "policy_version_id" VARCHAR
            ),
            "account" VARCHAR,
            "iam_role_arn" VARCHAR,
            "role_alias_arn" VARCHAR,
            "issuer_certificate_identifier" STRUCT(
                "issuer_certificate_subject" VARCHAR,
                "issuer_id" VARCHAR,
                "issuer_certificate_serial_number" VARCHAR
            ),
            "device_certificate_arn" VARCHAR
        ),
        "additional_info" MAP(VARCHAR, VARCHAR)
    )[],
    "reason_for_non_compliance" VARCHAR,
    "reason_for_non_compliance_code" VARCHAR,
    "is_suppressed" BOOLEAN
)
Show child fields
finding.check_name

The audit check that generated this result.

finding.finding_id

A unique identifier for this set of audit findings. This identifier is used to apply mitigation tasks to one or more sets of findings.

finding.finding_time

The time the result (finding) was discovered.

finding.is_suppressed

Indicates whether the audit finding was suppressed or not during reporting.

finding.non_compliant_resource

The resource that was found to be noncompliant with the audit check.

Show child fields
finding.non_compliant_resource.additional_info

Other information about the noncompliant resource.

finding.non_compliant_resource.resource_identifier

Information that identifies the noncompliant resource.

Show child fields
finding.non_compliant_resource.resource_identifier.account

The account with which the resource is associated.

finding.non_compliant_resource.resource_identifier.ca_certificate_id

The ID of the CA certificate used to authorize the certificate.

finding.non_compliant_resource.resource_identifier.client_id

The client ID.

finding.non_compliant_resource.resource_identifier.cognito_identity_pool_id

The ID of the Amazon Cognito identity pool.

finding.non_compliant_resource.resource_identifier.device_certificate_arn

The ARN of the identified device certificate.

finding.non_compliant_resource.resource_identifier.device_certificate_id

The ID of the certificate attached to the resource.

finding.non_compliant_resource.resource_identifier.iam_role_arn

The ARN of the IAM role that has overly permissive actions.

finding.non_compliant_resource.resource_identifier.issuer_certificate_identifier

The issuer certificate identifier.

Show child fields
finding.non_compliant_resource.resource_identifier.issuer_certificate_identifier.issuer_certificate_serial_number

The issuer certificate serial number.

finding.non_compliant_resource.resource_identifier.issuer_certificate_identifier.issuer_certificate_subject

The subject of the issuer certificate.

finding.non_compliant_resource.resource_identifier.issuer_certificate_identifier.issuer_id

The issuer ID.

finding.non_compliant_resource.resource_identifier.policy_version_identifier

The version of the policy associated with the resource.

Show child fields
finding.non_compliant_resource.resource_identifier.policy_version_identifier.policy_name

The name of the policy.

finding.non_compliant_resource.resource_identifier.policy_version_identifier.policy_version_id

The ID of the version of the policy associated with the resource.

finding.non_compliant_resource.resource_identifier.role_alias_arn

The ARN of the role alias that has overly permissive actions.

finding.non_compliant_resource.resource_type

The type of the noncompliant resource.

finding.reason_for_non_compliance

The reason the resource was noncompliant.

finding.reason_for_non_compliance_code

A code that indicates the reason that the resource was noncompliant.

finding.related_resources[]
Show child fields
finding.related_resources[].additional_info

Other information about the resource.

finding.related_resources[].resource_identifier

Information that identifies the resource.

Show child fields
finding.related_resources[].resource_identifier.account

The account with which the resource is associated.

finding.related_resources[].resource_identifier.ca_certificate_id

The ID of the CA certificate used to authorize the certificate.

finding.related_resources[].resource_identifier.client_id

The client ID.

finding.related_resources[].resource_identifier.cognito_identity_pool_id

The ID of the Amazon Cognito identity pool.

finding.related_resources[].resource_identifier.device_certificate_arn

The ARN of the identified device certificate.

finding.related_resources[].resource_identifier.device_certificate_id

The ID of the certificate attached to the resource.

finding.related_resources[].resource_identifier.iam_role_arn

The ARN of the IAM role that has overly permissive actions.

finding.related_resources[].resource_identifier.issuer_certificate_identifier

The issuer certificate identifier.

Show child fields
finding.related_resources[].resource_identifier.issuer_certificate_identifier.issuer_certificate_serial_number

The issuer certificate serial number.

finding.related_resources[].resource_identifier.issuer_certificate_identifier.issuer_certificate_subject

The subject of the issuer certificate.

finding.related_resources[].resource_identifier.issuer_certificate_identifier.issuer_id

The issuer ID.

finding.related_resources[].resource_identifier.policy_version_identifier

The version of the policy associated with the resource.

Show child fields
finding.related_resources[].resource_identifier.policy_version_identifier.policy_name

The name of the policy.

finding.related_resources[].resource_identifier.policy_version_identifier.policy_version_id

The ID of the version of the policy associated with the resource.

finding.related_resources[].resource_identifier.role_alias_arn

The ARN of the role alias that has overly permissive actions.

finding.related_resources[].resource_type

The type of resource.

finding.severity

The severity of the result (finding).

finding.task_id

The ID of the audit that generated this result (finding).

finding.task_start_time

The time the audit started.